Estimated read time: 3-4 minutes
SALT LAKE CITY — Several people in Utah are expressing concern with a proposed rule to govern how social media companies can verify the ages of users, saying it presents cybersecurity risks.
The Utah Division of Consumer Protection held a public hearing to hear feedback on the rule, which is designed to help enforce the state's Social Media Regulation Act. That law, signed earlier this year, provides a number of protections for minors on social media and requires parental consent for minors to create accounts.
While the law is aimed at protecting underage users, it will require that social media platforms verify the ages of all users in Utah.
Opponents of the law have shared concerns about privacy dating back to its introduction in the Legislature in January and many of those concerns were echoed again Wednesday. The hearing was only for input on the rule governing the manner of age verification, though, and concerns about the underlying policy itself should be directed to lawmakers for consideration, said Katie Hass, director of the Division of Consumer Protection.
Several comments about the rule argued that it relies too much on information like government-issued IDs or Social Security numbers, rather than allowing companies to use more creative technologies to verify age while better protecting privacy.
"It's our view that the mechanisms laid out in this rule are too restrictive, and because they're so restrictive, they lean more toward identity verification rather than age verification," said Caden Rosenbaum, who spoke on behalf of the Libertas Institute, a Lehi-based think tank.
He said the group has two primary concerns: privacy risk because of the use of government IDs and infringement on free speech rights.
"These kinds of restrictive age verification mechanisms that lead toward identity verification, really restrict anonymous speech," he said, because many users will be required to show a driver's license or similar identification. "That mechanism of needing to verify who you are could stifle the speech, and stifling speech is a First Amendment concern whenever it's the government's requirements."
Alex Zieg, the founder and CEO of age verification company BlueCheck, said companies are able to verify the ages of users "pretty anonymously," and "without (users) giving away too much personally identifiable information."
One of the options social media companies would be allowed to use under the proposed rule is to analyze facial features to estimate age, which is currently an effective method, according to Iain Colby, who represents the Age Verification Providers Association, a trade group of companies that provide those services.
The rule requires that companies delete any data collected to verify age within 45 days.
The acceptable methods include the following, as written in the rule:
- Validating and verifying mobile telephone subscriber information.
- Using dynamic knowledge-based authentication consistent with the method approved by the Federal Trade Commission.
- Estimating a current account holder's age based on the date a Utah account holder created the account.
- Checking a current or prospective account holder's Social Security number's last four digits against a third-party database of personal information.
- Estimating a current or prospective account holder's age using facial characterization or analysis.
- Matching a current or prospective account holder's verified government-issued identification to a live webcam photo or video of the person, or to the person who is physically present.
- Companies can also use other forms of digital credentials that are established using one of the final two options listed.
Members of the public can still submit written feedback on the rule through Feb. 5, 2024, by visiting socialmedia.utah.gov. The Social Media Regulation Act goes into effect March 1, 2024, though Gov. Spencer Cox said he expects lawmakers may tinker with the policy before then.
